Critical · 10.0 CVE-2016-1000273 GHSA-cqhr-jqvc-qw9p

Java Melody vulnerable to cross-site scripting

Published Jul 20, 2022 · Updated Sep 10, 2026 · Assigned by GHSA

Package: net.bull.javamelody:javamelody-core Ecosystem: Maven

Description

JavaMelody is a monitoring tool for JavaEE applications. Versions prior to 1.61.0 are vulnerable to a cross-site scripting (XSS) attack. This issue was patched in version 1.61.0, and users are recommended to upgrade to the latest version. There are no known workarounds.

Affected packages

Ecosystem	Package	Affected	Fixed	Record
Maven	net.bull.javamelody:javamelody-core	< 1.61.0	1.61.0	GHSA-cqhr-jqvc-qw9p

References

https://github.com/javamelody/javamelody/commit/e0497c1980acebd257d3da78dfde29ae9bdffdf6 web
https://github.com/javamelody/javamelody package
https://github.com/javamelody/javamelody/wiki/ReleaseNotes#1620 web